Account Escalation Request

Changing the password does not confirm that the escalation request is finished; sign in and determine whether the attacker changed an account alias or the account’s security information, then use the matching procedure below.

If the changed email is an account alias

An alias is an email address used to sign in to the same Microsoft account. All aliases share the account’s password, contacts, storage, subscriptions, and settings.^1^

1. Open Your info → Edit account info at
   https://account.live.com/names/manage
2. Select Add email and add an address that you control.
3. If appropriate, make your address the primary alias.
4. Select Remove beside the attacker’s address—but only after confirming it is not yours and that you retain a working sign-in address.

If alias management is blocked, use the guided support tool linked on that page. Microsoft support agents cannot directly access or change account details.^1^

If the changed email receives verification codes

That is security information, not necessarily a sign-in alias. If the Security page displays “Your security info change is still pending” or “You can’t access this site right now,” all previous verification methods were removed and replaced, placing the account in a restricted 30-day period.^2^

Because you did not initiate that change:

1. Open the Microsoft account Security page:
   https://account.live.com/proofs/Manage
2. In the Your security info change is still pending window, select Let us know.
3. Complete the unauthorized-change prompts.

Do not select Cancel this request unless you initiated the security-information replacement yourself and can access the previous verification methods. Microsoft cannot expedite the 30-day period; if two-factor verification is active, the documented options are to wait or use the available cancellation/reporting procedure.^2^

Escalation status and additional forms

Microsoft does not publish a separate public page where personal-account users can inspect an “Account Escalation Request” status. A successful password change alone does not establish whether that case was closed.

• Check the alternate contact address used for the request, including its junk folder, for a decision or case-response email.
• Reply to the existing case email if replies are accepted; keeping the original case number preserves continuity.
• If no status was provided, open Contact Microsoft Support, enter Account Recovery, select Get Help, and then Contact Support. The hacked-account sign-in helper can also offer self-help or an agent option.^3^

You normally should not submit another recovery form merely because the email has not yet been restored. You have already completed that form; the next action is the alias or security-information procedure above. A different reinstatement form applies only if Microsoft specifically says the account is locked or disabled, not simply because an attacker changed its email.^4^

Secure the recovered account

After regaining control:

1. Run a full malware scan on devices used with the account.
2. Review Outlook.com connected accounts, forwarding, and automatic replies for attacker-created changes.^3^
3. Review recent sign-in activity and remove unrecognized access.
4. Add verification methods you control, preferably more than one, and enable Microsoft Authenticator or another strong sign-in method.^5^

References

1. Change the email address for your Microsoft account | Microsoft Support
2. What does “Security info change is still pending” mean? | Microsoft Support
3. How to recover a hacked or compromised Microsoft account | Microsoft Support
4. Account got hacked - Microsoft Q&A
5. How to help keep your Microsoft account secure | Microsoft Support